From 217d0f33eae50a82ecccb2a4593a11a72fe94220 Mon Sep 17 00:00:00 2001 From: Robert DeLanghe Date: Thu, 30 Jul 2026 22:43:11 +0000 Subject: [PATCH] =?UTF-8?q?ci:=20drop=20adoption=20grace=20=E2=80=94=20run?= =?UTF-8?q?=20the=20osv=20lane=20at=20hard-fail=20(ci-workflows#8)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The report-only flag was adoption grace so a pre-existing advisory could not block instrumentation. It was always meant to be temporary, and it has no expiry or owner, so a repo left holding it shows a green check that gates nothing. This repo's scan is clean, so grace comes off: a known vulnerability now reds the lane, which is the template's intended steady state. Self-verifying by construction — if this repo did still carry a finding, this PR's own osv check goes red and it does not get merged. Co-Authored-By: Claude Opus 5 --- .github/workflows/deps.yml | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml index ff49a10..8dbf430 100644 --- a/.github/workflows/deps.yml +++ b/.github/workflows/deps.yml @@ -13,18 +13,8 @@ name: deps # (OSV has no JSR ecosystem). A repo with nothing scannable passes rather than # red-lining. # -# Failure posture is HARD-FAIL by default. This template ships `report-only: true` -# as an ADOPTION GRACE setting: 5 of the first 8 repos scanned carried pre-existing -# advisories, and blocking adoption on remediation would mean most repos stay -# UNINSTRUMENTED while their findings go unseen. Grace decouples "we can see it" -# from "we have fixed it". -# -# >>> DELETE THE `report-only: true` LINE BELOW once this repo's findings are clear. -# >>> That flips it to hard-fail, which is the intended steady state. -# Progress tracked in ci-workflows#2. -# -# Grace downgrades VULNERABILITY findings only. A tool or network failure still fails -# hard in every mode — a lane that cannot run must never report green. +# Failure posture: HARD-FAIL. Adoption grace was removed once this repo's scan +# came back clean (ci-workflows#8) — a known vulnerability now reds the lane. # # The reviewable escape hatch for an accepted or unfixable finding is an # osv-scanner.toml [[IgnoredVulns]] entry next to the lockfile, with a written reason. @@ -54,5 +44,3 @@ jobs: # SHA-pinned per org policy. `# main` records what the SHA was at the time, so a # reviewer can tell an intentional bump from a drifted one. uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@62990dd15f1b0deba21e597bebd1512970544c15 # main - with: - report-only: true # adoption grace — delete this once findings are clear (ci-workflows#2)